danabot

General

Target

file.exe
Size

214KB
Sample

221217-3wpw3sda3t
MD5

c1be0d5de42908e9a62b94a46dcc17ce
SHA1

c2e3a40bd903682f5b971a5bd7c7af3c88ae0981
SHA256

f378d08ccdf697a50548e7d9bd56f102ffadd88f3306b7253f803e3047303829
SHA512

80be552b2f2de1aed5cd1bb14241dbdd4274bc0a726ab33f42a5fad174d4c33637b74a25c38188bee1080b647ec33499768e20fa119c7d0349832672f78dbb34
SSDEEP

3072:S3Nms4LLuOPZwRop1prfy61HPP7oPUVVEGLSkO8/g3xomDMrG3ERWR3Le:eNmhLLuOPn+gHPSUvEGmkTg3Co5U0V6

Score

10^/10

Malware Config

Extracted

Family

danabot

C2

23.236.181.126:443

123.253.35.251:443

66.85.173.3:443

Attributes

embedded_hash
8F56CD73F6B5CD5D7B17B0BA61E70A82
type
loader

Targets

- Target
  
  file.exe
- Size
  
  214KB
- MD5
  
  c1be0d5de42908e9a62b94a46dcc17ce
- SHA1
  
  c2e3a40bd903682f5b971a5bd7c7af3c88ae0981
- SHA256
  
  f378d08ccdf697a50548e7d9bd56f102ffadd88f3306b7253f803e3047303829
- SHA512
  
  80be552b2f2de1aed5cd1bb14241dbdd4274bc0a726ab33f42a5fad174d4c33637b74a25c38188bee1080b647ec33499768e20fa119c7d0349832672f78dbb34
- SSDEEP
  
  3072:S3Nms4LLuOPZwRop1prfy61HPP7oPUVVEGLSkO8/g3xomDMrG3ERWR3Le:eNmhLLuOPn+gHPSUvEGmkTg3Co5U0V6
Score

10^/10

smokeloader backdoor trojan danabot banker discovery
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects Smokeloader packer

SmokeLoader

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2